Cybercrime, the email “Request Quotation PO.230029” conveys Vjw0rm
The js in the rar attachment contacts a url to download and run an exe: the malware. The mail provider is the same as yesterday's Remcos campaign.
Cybercrime, Vjw0rm goes back to hiding in an email on beauty products
The “$38,570 detailed Invoice Payment” email rar attachment contains a js file: the malware.
Cybercrime, the beauty products-themed malspam campaign now carries Vjw0rm
The new template email .js attachment is directly the malware. Until now, it was spreading AgentTesla via rar file.